trevon/glove
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
No description
132 commits 18 branches 0 tags 1.9 MiB
  • C++ 96%
  • CMake 1.6%
  • Shell 1.3%
  • Python 1.1%
Find a file
Exact
0xkite 161b30616d
 fix(control): stop runtime-root subdirectory staging from failing local-service identity 
The local-service proxy factory's operational identity rechecked the
runtime root with the exact dev/ino/uid/mode/nlink tuple, but a
directory's st_nlink is 2 plus its subdirectory count on ext4, tmpfs,
and APFS. Every prepare_session mkdirat(2)s a svc-* staging directory
under that root (and inode-safe teardown removes it), so the root's
link count necessarily changes and the factory itself - or any second
factory sharing the same runtime root - failed the next operational
check as false "identity drift". Proven on Ghost at base 4900bda4:
baseline LastTest.log line 666, root nlink 2 -> 3 verified by
instrumentation; the whole downstream local-service test flow was
blocked. The term could never distinguish sanctioned staging from
tampering: only subdirectory creation moves a directory's nlink, files
and symlinks do not, and writes to this owner-only root are trusted
operator authority per session-policy. The production runtime root is
also shared with the gloved instance lock and control socket, so entry
enumeration whitelisting would add no real enforcement claim.

Drop only the root nlink term from operational(): the root's
dev/ino/uid/mode stay exact (replacement and permission drift still
fail closed, covered by the existing chmod test), and the
descriptor-pinned endpoint parents and sockets retain the exact
dev/ino/uid/mode/nlink recheck in endpoint_current(), which is where
the recorded endpoint identity drift claim (architecture.md) lives.
Unknown drift remains fail-closed.

Add a deterministic regression: two factories sharing one runtime root,
and one factory preparing consecutive sessions, must stay operational
across a prepare_session, while chmod on the root still fails closed.
The test fails on pre-fix code (Ghost: operational() false at the first
post-prepare check).

While validating on Ghost (kernel 6.12), the test's downstream
guest-socket ABA section needed two determinism repairs of its own,
both previously unreachable there because the baseline always failed
earlier: resolve the session directory by its exact staged svc-* name
instead of readlink of the detached open_tree mount (6.12+ renders
detached mount roots as "/" in /proc/self/fd), and stage the ABA
replacement listener at a fresh path before swapping it in so the
replacement cannot recycle the just-freed socket inode (the documented
same-UID ABA caveat) and accidentally satisfy the identity check.
2026-08-31 17:46:28 -06:00
.agents/skills/glove-cpp-change fix: close Apple lifecycle review gaps 2026-08-28 21:53:35 -04:00
.github fix(ci): isolate namespace test leak tracing 2026-08-14 17:50:56 -06:00
benchmarks perf(mcp): add validation benchmark 2026-07-21 22:24:49 -04:00
cmake fix(ci): validate complete fuzzer policies 2026-08-14 16:10:42 -06:00
dockerfiles feat(remote): add construction-only backend 2026-08-07 22:27:35 -04:00
docs docs: session policy, threat model, and architecture for the channel layer 2026-08-30 20:28:41 -06:00
fuzz refactor(control): remove synthetic wallet status stack 2026-08-30 20:28:37 -06:00
include/glove fix(control): report start replay disposition, hard-cap jsonl audit journal, deterministic control tests 2026-08-31 09:34:45 -06:00
packaging feat(refinement): evaluate fixtures in sandbox 2026-07-31 16:07:43 -04:00
scripts docs: session policy, threat model, and architecture for the channel layer 2026-08-30 20:28:41 -06:00
src fix(control): stop runtime-root subdirectory staging from failing local-service identity 2026-08-31 17:46:28 -06:00
tests fix(control): stop runtime-root subdirectory staging from failing local-service identity 2026-08-31 17:46:28 -06:00
tools feat(remote): add construction-only backend 2026-08-07 22:27:35 -04:00
.clang-format Initial Glove sandbox baseline 2026-07-19 21:06:11 -04:00
.clang-tidy Initial Glove sandbox baseline 2026-07-19 21:06:11 -04:00
.dockerignore feat(host): guide managed harness setup 2026-07-29 16:15:04 -04:00
.editorconfig Initial Glove sandbox baseline 2026-07-19 21:06:11 -04:00
.gitignore feat(control): add Glove wallet status bridge core 2026-08-29 09:47:49 -06:00
AGENTS.md Add Codex engineering workflow 2026-07-19 21:09:24 -04:00
CMakeLists.txt feat(control): neutral guest channels, quarantine recovery, capability sealing, local-service proxy 2026-08-30 20:28:41 -06:00
CMakePresets.json test(fuzz): cover untrusted parser boundaries 2026-07-21 22:23:45 -04:00
CREDITS.md Initial Glove sandbox baseline 2026-07-19 21:06:11 -04:00
LICENSE Initial Glove sandbox baseline 2026-07-19 21:06:11 -04:00
README.md fix(onboarding): harden setup plan 2026-08-03 09:19:50 -04:00
setup.sh build: select compatible C++ runtime 2026-07-29 17:32:40 -04:00

README.md

Glove

Glove contains an LLM agent in an OS-enforced sandbox. It denies files, environment, network, and tool access unless an operator grants them explicitly.

Status: research prototype. Remote Sage launch remains disabled until its lifecycle, approval, and resource-enforcement contracts are complete.

Start here

./setup.sh

For development:

cmake --preset dev
cmake --build --preset dev
ctest --preset dev

Use docs/build.md for prerequisites, controlled/offline builds, and Linux runtime requirements. Use docs/host-setup.md to plan and apply owner-local managed session setup.

Why Glove

Glove is a containment boundary, not a prompt-injection detector or a complete host-security boundary. The motivation, trust boundaries, and residual risks are in docs/architecture.md and docs/threat-model.md.

Documentation

License

Glove is licensed under GPL-3.0-only. See CREDITS.md for dependency licenses and research references.